feat(ecosystem): compliant Praxis/Hexis integration + vendored build

Bring the Nexus/Praxis/Hexis integration in line with
MAVEN_ECOSYSTEM_ARCHITECTURE.md:

- Praxis over HTTP: drop the in-process praxis.db open (praxisstore/
  praxistools) and call praxisd's /api/v1/tools/* API via a new praxisClient.
  Honors the "no component reads another's DB" invariant (AC#12).
  PraxisConfig.DBPath -> URL.
- Hexis confirmation gate: mutating capabilities (ReadOnly=false) now park a
  bound pendingHexis confirmation and require a spoken "да" before executing;
  read-only run immediately (AC#7, no auto attention->action).
- Capability safety: >1 verb match is ambiguous -> ask instead of firing the
  first; ambiguous Nexus resolution asks for clarification (AC#2).
- Correlation IDs on Hexis execute, recorded in the cross-service trace.
- Bug: importance arrives as JSON float64 over HTTP, not int.
- Tests: confirm-gate, decline, read-only, and ambiguity paths.

Build: vendor/ bakes in the hexis client (replace-directed at a sibling repo
outside the Docker context); Dockerfile builds from vendor and no longer
`go mod download`s the unreachable replace paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vendor/modernc.org/sqlite/fcntl.go

@@ -0,0 +1,58 @@
+// Copyright 2024 The Sqlite Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package sqlite // import "modernc.org/sqlite"
+
+import (
+	"unsafe"
+
+	"modernc.org/libc"
+	sqlite3 "modernc.org/sqlite/lib"
+)
+
+// Access to sqlite3_file_control
+type FileControl interface {
+	// Set or query SQLITE_FCNTL_PERSIST_WAL, returns set mode or query result
+	FileControlPersistWAL(dbName string, mode int) (int, error)
+	// Query SQLITE_FCNTL_DATA_VERSION, returns the pager-cache data version
+	// for dbName. The value changes whenever the contents of the database
+	// file change, which makes it suitable for cache-invalidation use cases.
+	// See
+	// https://www.sqlite.org/c3ref/c_fcntl_begin_atomic_write.html#sqlitefcntldataversion.
+	FileControlDataVersion(dbName string) (uint32, error)
+}
+
+var _ FileControl = (*conn)(nil)
+
+func (c *conn) FileControlPersistWAL(dbName string, mode int) (int, error) {
+	pi32 := c.tls.Alloc(4)
+	defer c.tls.Free(4)
+
+	*(*int32)(unsafe.Pointer(pi32)) = int32(mode)
+	err := c.fileControl(dbName, sqlite3.SQLITE_FCNTL_PERSIST_WAL, pi32)
+	return int(*(*int32)(unsafe.Pointer(pi32))), err
+}
+
+func (c *conn) FileControlDataVersion(dbName string) (uint32, error) {
+	pu32 := c.tls.Alloc(4)
+	defer c.tls.Free(4)
+
+	*(*uint32)(unsafe.Pointer(pu32)) = 0
+	err := c.fileControl(dbName, sqlite3.SQLITE_FCNTL_DATA_VERSION, pu32)
+	return *(*uint32)(unsafe.Pointer(pu32)), err
+}
+
+func (c *conn) fileControl(dbName string, op int, pArg uintptr) error {
+	zDbName, err := libc.CString(dbName)
+	if err != nil {
+		return err
+	}
+	defer c.free(zDbName)
+
+	if rc := sqlite3.Xsqlite3_file_control(c.tls, c.db, zDbName, int32(op), pArg); rc != sqlite3.SQLITE_OK {
+		return c.errstr(rc)
+	}
+
+	return nil
+}